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(54) Converter encryption/decryption system, multi-stage converter, converting method, 
multi-stage converting n^thod, program, and information recording medium 



(57) A converter 1 01 uses a predetemriined param- 
eter a. A generating unit 102 accepts generated Inputs 
x^,..., Xn, and generates generated outputs, y^, y„, 
using recurrence formulas, y^ = Fi (x^, a) andyi^.^ = F|^i 
(X|^i, yi) (1 ^i<n-1 ). A key accepting unit 1 03 accepts key 
Inputs, k^,..., I<„, and gives them as generated inputs to 
said generating unit 102. A repetition controller 104 
gives the generated outputs as generated Inputs to said 



generating unit 102, for an "m" (m^O number of times, 
and sets one of the generated outputs to be given at the 
end as a random number string, r^,..., r^. The data ac- 
cepting unit 105 accepts dafa inputs, d^,..., d^. The con- 
verting unit 106 converts data using, ei = d|^ r|, and, 
outputs data outputs, e^, .... e„. The converter 101 can 
be used both for encrypting and decrypting data. 
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Description 

[0001 ] The present invention relates to a converter, an encryption/decryption system, a multi-stage converter, a con- 
verting method, a multi-stage converting method, a program and an information recording medium recording infomia- 
5 tion, which are preferable for a vector-stream private key encryption system. 

[0002] Conventionally, as a private key encryption system, a block encryption method or a stream encryption method 
are known. The standard of the block encryption method includes DES, RC5, etc., and the standard of the stream 
encryption method includes RC4, SEAL 1.0, etc. 

[0003] According to the stream encryption method, a random bit string is generated, and an exclusive OR operation 
10 is applied between target data to be encrypted and this generated random bit string, thereby encrypting the target data. 
Hence, the encryption speed depends on the generation speed of the random bit string, so that the encryption can be 
realized generally at high speed. The stream encryption method Is prefen"ed for the contents (mobile communications, 
etc.) wherein bit errors are not negligible, and realizes flexible change in the data fonmat. 

[0004] In the block encryption method, non-linear mixing of data, i.e. an "S" function, is used. Data processing Is 
15 performed in the unit of blocks, it is an advantageous aspect that various data fomnats (image data, audio data, motion 
pictures, etc.) can be employed In this encryption method. However, if there is a bit error in the data, the en-or may be 

diffused. 

[0005] It is highly demanded that there should be a private key encryption system having both the advantage of the 
above-described stream encryption technique and the advantage of the block encryption technique. 
20 [0006] In particular, demanded is a private key encryption system which is suitable for encrypting a large volume of 
data, such as large-scale databases, image data, audio data, motion pictures, etc. 

[(K)07] The present invention has been made in consideration of the above. It is accordingly an object of the present 
invention to provide a converter, an encryption/decryption system, a multi-stage converter, a converting method, a 
multi-stage converting method, a program and an Information recording medium, which are preferable for a vector- 
's stream private key encryption system. 

[0008] In order to accomplish the above object, according to the first aspect of the present Invention, there is provided 
a converter (101) using: 

an "n" (n^1) number of conversion functions, F,: AxA^A (1<i5n), with respect to a domain A; 
30 a binary arithmetk: operation, "Ar : AxA->A, and its reverse binary arithmette operation, @ ; AxA^A, wherein, 

for arbitrary x G A, y G A, conditions of 

(x'&y)@y= x, and 

(>®y)* y=x 

are satisfied; and 
35 a predetemiined parameter, a G A, and 

the converter (101) comprising a generating unit (102), a key accepting unit (103), a repetition controller (104), 
a data accepting unit (105), and a converting unit (106), and 
characterized in that: 

40 

the generating unit (102) accepts generated Inputs, x^, Xg, x^ G A, whose length is "n" in total, and generates 
generated outputs, y^, yg, y^ G A, whose length is "n" in total using recurrence fonnulas 

45 yi = Fi(x^.a), 

and 

50 yM-FM(XM.y,)(1^l^n-1): 

the key accepting unit (103) accepts key inputs, k^, kg, k„ G A, whose length Is "n" in total, and gives the 
accepted key inputs as generated inputs to the generating unit (102); 

the repetition controller (104) gives the generated outputs from the generating unit (102) as generated inputs to 
55 the generating unit, for an "m" (m>0) number of times, and sets one of the generated outputs to be given at end 
as a random number string, r^, rg, r^ G A, whose length is "n" in total; 

the data accepting unit (105) accepts data inputs, d^, dg, .... d^^G A, whose length is "n" in total; and 
the converting unit (106) converts data for any integers "i" in a range between 1 and "n" using a fonnula 



2 



EP1 289186 A2 



and 

outputs data outputs, e^, eg G A, whose length is "n" in total. 

[0009] In order to accomplish the above object, according to the second aspect of the present Invention, there Is 
provided a converter (301) using: 

an "n" (n>1) number of conversion functions, F,: AxA-^A {1<l<n). with respect to a domain A; 

a binary arithmetic operation, ife : AxA^A. and its reverse binary arithmetic operation,® : AxA-4A, wherein, 

for arbitrary x G A, y G A, conditions of 

(x'3wfy)(o)y^x. and 

()<o)y) it y=x 

are satisfied; and 
a predetermined parameter, a G A, and 

the converter (301) comprising a generating unit (302), a l<ey accepting unit (303). a repetition controller (304) 
a data accepting unit (305), and a converting unit (306), and 
characterized in that: 

the generating unit (302) accepts generated inputs, x^, X2, .... x„ g A, whose length is "n" in total, and generates 
generated outputs, y^, yg y^ G A, whose length is "n" in total using recurrence formulas, 

Yi-F^ (x^.a). 

and 



yi+i = F'M (Xi+i.X|)(1^i:$n-1); 

the key accepting unit (303) accepts key inputs , k^ , kg, . . . , k„ G A whose length is "n" In total, and gives the accepted 
key Inputs as generated inputs to the generating unit (302); 

the repetition controller (304) gives the generated outputs from the generating unit (302) as generated inputs to 
the generating unit, for an "m" (m>0) number of times, and sets one of the generated outputs to be given at end 
as a random number string, r^, r2, .... rnG A, whose length is "n" in total; 

the data accepting unit (305) accepts data inputs, d^, dg, d^ G A, whose length Is "n" in total; and 
the converting unit (306) converts data for any integers "i" in a range between 1 and "n" using a fomiula 

and 

outputs data outputs, e^. eg, .... e^ G A, whose length Is "n« In total. 

[0010] In the above converter, each of the binary arithmetic operations® and -ft may be exclusive OR. 
[0011] In the above converter, 

at least one of the conversion functions F, defined by define positive integers M, s, may satisfy following conditions 
for an arbitrary integer parameter b (l^bsM^). 



F, (X, b) = cell (xM*/b)(1<x^b), 

and 



F, (X, b) = floor (M* (x-*)/(M'-b)) + 1 (b<x^M'). 
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In cases where: 

-ceil {•)** represents that decimals should be rounded off to a next whole number in "M" number system; and 
"floor (•)" represents that decimals should be cut off in "M" number system. 

5 

[0012] In the converter, 

at least one of the conversion functions Fj defined by positive integers M, s, may satisfy following conditions, for 
an arbitrary integer parameter, b (1^b^M*), 

F,(y.b) = x^(q<x^): 
Fi(y. b)=:X2 (Xi^q), 

15 

where 

x^= floor (M"* by); 

20 

Xg-ceil ((M'^b-l)y-i-M^); 

2s q = b(X2-M"y(b-M'), 

in cases where: 

"ceil (•)" represents that decimals should be rounded off to a next whole number in "M" number system; and 
30 "floor (•)" represents that decimals should be cut off in "M" number system. 

[001 31 In order to accomplish the above object, according to the third aspect of the present invention, there Is provided 
an encryption/decryption system (501 ) including the above-described converter as an encrypting unit (502) and another 
converter having a same structure of a structure of the converter as a decrypting unit (503), and said system being 

35 characterized In that: 

"F",@ , and ''a", are commonly used by the encrypting unit and the decrypting unit; 
a condition, x "ir y = )<o) y is satisfied for an arbitrary x G A and y G A; 

the encrypting unit (502) and the decrypting unit (503) commonly accepts l<ey inputs, k^, k2, k^; 
40 the encrypting unit (502) accepts original data whose length Is *n", as a data input, and outputs a data output 
whose length is "n" as encrypted data; and 

the decrypting unit (503) accepts the encrypted data whose length is "n", as a data input, and outputs a data output 
whose length is "n" as decrypted data. 

45 [0014] In order to accomplish the above object, according to the fourth aspect of the present invention, there is 
provided a converter using: 

an "n" (n^1 ) number of conversion functions F,: Ax A-^A (1 <i^n) and their reverse conversion functions G,: Ax A->A, 
with respect to a domain A, wherein, for arbitrary x e A and y e A, conditions of 

50 

F| (G, (x,y), y)-x, 

and 

55 

G| (F| (X, y), y) - X, 
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are satisfied; 

a binary arrthmetic operation, An^A". and its reverse binary arithmetic operation, © : An^A", wherein for 
arbitrary z e A", conditions of w » , 

© z) = z, and 

® (t!r z)-z 

are satisfied; and 
a predetemilned parameter, a G A, and 

the converter comprising a generating unit, a data accepting unit, a repetition controller, and a converting unit and 
charactenzed in that: ^ * 

the generating unit accepts generated inputs, x,. Xg. .... x„ G A. whose length is "n« in total, and generates 
generated outputs, y^. y„ s A. whose length Is "n- In total using recurrence formulas 



yi = Fi {xi,a). 

and 



the data accepting unit accepts data inputs. k„ k^, .... k, g A. whose length is »n" in total, and gives the 
accepted data inputs as generated Inputs to the generating unit; 

the repetition controller gives the generated outputs from the generating unit as generated inputs to the gen- 
erating unrt. for an "m" (m^ number of times, and sets one of the generated outputs to be given at end as a 
random number string, r,, rg, G A, whose length is "n" in total; and 

the converting unit appiies a single-temi arithmetic operation. to the random number strina r, re 
A, to perform Its data conversion, that is. ^' ^' "*' " 



and 

outputs data outputs, e^. eg. .... e„, whose length Is "n" in total. 

[001 5] In order to accomplish the above object, according to the fifth aspect of the present invention, there is provided 
a convener using: 

"^^ber of conversion functions. F,: AxA^A (l^l^n). and their reverse convereion functions. G,: 
AX A^A, with respect to a domain A, wherein, for arbitrary x G A and y G A, conditions of 



F, (G, (x,y).y)=.x, 

and 



G| (F, (x.y).y) = x. 

are satisfied; 

a binary arithmetic operation, *: An-^A". and its reverse binary arithmetic operation. ® : AH-^A" wherein for 
arbitrary z G A", conditions of ' 

* (®z)-z, and 

® (ir z)=z 

are satisfied; and 
a predetennined parameter, a G A, and 

the converter comprising a generating unrt. a data accepting unit, a converting unit, and a repetition controller, and 
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being characterized in tliat: 

the generating unit accepts generated inputs, x^, Xg, . .. x„ G A, whose length is "n" in total, and generates 
generated outputs, y^, Vn ^ A. whose length is "n" in total using recurrence fonnulas, 

5 

y^=Gi (Xi,a), 



and 

10 

the data accepting unit accepts data inputs, h^, ha, .... h^G A, whose length is "n" in total; 
15 the converting unit applies a single-term arithmetic operation, to the data inputs, h^, hg, h„. to perfonn 

its data conversion, that is, 



and 

ves results of the data conversion, v.,, Vg v^, to the generating unit; and 

the repetition controller gives the generated outputs from the generating unit as generated inputs to the gen- 
25 eratlng unit, for an "m" (m^O) number of times, and sets one of the generated outputs to be given at end as 
data outputs, s^. Sg e A, whose length Is "n" In total. 

[0016] In the above converter, 

in cases where "A" represents a T-number bit space, and "z G A"*' corresponds to a bit string having "tn" bits in 
30 length. In the single-term arithmetic operation @ . bits in the bit string may be shifted by a predetermined number of 
bits in a predetermined direction, and its resultant bit string may be set to correspond to A"^, thereby obtaining a result 
of the single-temn arithmetic operation® . 
[0017] In the converter, 

at least one of the conversion functions, F,, defined by positive Integers M, s, satisfy following conditions, for an 
35 arbitrary integer parameter b (1 <to^Ms) , 

F,(x,b) = ceil (xM*/b) (1^x<b), 



40 and 

F, (X, b) - floor (M' (x-b)/(M*-b)) + 1 (b<x<M'), 

4S in cases where: 

"ceil (*Y represents that decimals should be rounded off to a next whole number in "M" number system; and 
••floor (0" represents that decimals should be cut off In "M" number system. 

50 [0018] In the converter, 

at least one of the conversion functions, F|, may define positive Integers M, s, and satisfy following conditions, 
for an arijitrary integer parameter, b (1^M»), 

F|(y. b) = Xi (q<x^); 

55 



Fj (y. b) = X2 (x^:Sq). 
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where 



= floor (M'® by); 

5 

X2 = cen ((MVljy+M'); 



10 q = b (X2-MV(b-M*), 

in cases where: 



"cell (.)" represents that decimals should be rounded off to a next whole number In "M" number system- and 
"floor (.)" represents that decimals should be cut off In "M* number system. 

[001 9] In order to accomplish the above object, according to the sixth aspect of the present Invention, there is provided 
an encryption/decryption system including the above-described former converter as an encrypting unit and the above- 
described latter converter as a decrypting unit, and being characterized in that: 

"P", "Gj", " and V, are commonly used by the encrypting unit and the decrypting unit* 

the encrypting unit accepts original data as data Inputs, k^, .... k„, whose length is "n" In total, and outputs data 
outputs, e^. e^, ep, whose length is "n" in total as encrypted data; and 

the decrypting unit accepts the encrypted data whose length is "n" in total, as data Inputs, h^, ha, h-, and outputs 
data outputs, s^, Sg, s^, whose length is "n" in total as decrypted data, 

[0020] In order to accomplish the above object, according to the seventh aspect of the present invention there is 
provided an encryption/decryption system including the above-descrlbed former converter as an encrypting' unit and 
the above-described latter converter as a decrypting unit, and being characterized In that: 

"F", "Gj", " ^ 1® and V are commonly used by the encrypting unit and the decrypting unit; 
the encrypting unit accepts original data as data inputs, h^, hg. h„, whose length is "n" In total, and outputs data 
outputs, s^, Sn, whose length is "n" in total as encrypted data; and 

the decrypting unit accepts the encrypted data whose length is "n" in total, as data Inputs, . kg k„, and outputs 

data outputs, e^, eg, e^, whose length Is "n" In total as decrypted data. 

[0021] In order to accomplish the above object, according to the eighth aspect of the present Invention, there Is 
provided a multi-stage converter characterized by comprising: 

a "u" number of above-described latter converters (a 7'-th converter is called a converter M. (i^j^u))- and 

a multi-stage key-input accepting unit which accepts parameter Inputs a^, aa a„ e A. and sets a T-th parameter 

input, aj, included in the accepted parameter Inputs, as a predetennined parameter "a" of the converter and 
wherein ^' 

a converter Included in the "u" number of converters accepts multi-stage conversion inputs k. k« k whose 
length is "n" in total, as data inputs, 

data outputs, which are output by a converter M, (1<l^u-1) included in the "u" number of converters, are given to 
a converter Mj^^ included in the "u" number of converters, as data Inputs, and 

a converter M„ included In the "u" number of converters outputs data outputs, e.. e^ e„. whose length Is "n" In 

total, as multi-stage conversion outputs. 

[0022] In order to accomplish the above object, according to the ninth aspect of the present invention, there is pro- 
vided a multi-stage converter characterized by comprising: 

a "u- number of above-described latter converters (a -j-.th converter is called a converter M, (1<j<u)) accordinq to 
55 claim 7; and ^ 

a multi-stage key-input accepting unit which accepts parameter Inputs a^ , ag a, g A, and sets a T-th parameter 

input, aj, included In the accepted parameter Inputs, as a predetermined parameter "a" of the converter M. and 
wherein 
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a converter Included in the ''u" nunnber of converters accepts multi-stage conversion inputs, h^, lig h^, whose 

length is "n' in total, as data inputs, 

data outputs, which are output by a converter M^^^ (1<l<u-1) included in the "u" number of converters, are given 
to a converter M| included In the "u" number of converters, as data Inputs, and 
5 a converter included In the "u" number of converters outputs data outputs, s^, $2, s^, whose length is "n" in 

total, as multi-stage conversion outputs. 

[(K)23] In order to accomplish the above object, according to the tenth aspect of the present invention, there is pro- 
vided an encryption/decryption system including the above-described fomier multi-stage converter as an encrypting 
10 unit and the above-described latter multi-stage converter as a decrypting unit, and characterized in that: 

"F,", "G|", " "ft and are commonly used by the encrypting unit and the decrypting unit; 
parameter Inputs, a^, 82, a^, are commonly accepted by the encrypting unit and the decrypting unit; 
the encrypting unit accepts original data as multi-stage conversion inputs, k^, l<2, k^, whose length is^n" in total, 
15 and outputs multi-stage conversion outputs, e^ , 62, .... en, whose length is "n" in total as encrypted data; and 

the decrypting unit accepts the encrypted data whose length is "n" in total, as multi-stage conversion inputs, h^, 
hg. h„, and outputs data outputs, s^, Sg, .... whose length Is "n" In total as decrypted data. 

[0024] In order to accomplish the above object, according to the eleventh aspect of the present Invention, there is 
20 provided an encryption/decryption system including the above-described latter multi-stage converter as an encrypting 
unit and the above-described fomner multi-stage converter as a decrypting unit, and being characterized In that: 

"F|\ "Gj", " and 'to) ", are commonly used by the encrypting unit and the decrypting unit; 
parameter inputs, a^, a2, a^, are commonly accepted by the encrypting unit and the decrypting unit; 

25 the encrypting unit accepts original data as multi-stage conversion inputs, h^, h2 h^, whose length Is "n" In total, 

and outputs multi-stage conversion outputs, s^, S2, .... s^, whose length Is "n" In total as encrypted data; and 
the decrypting unit accepts the encrypted data whose length Is "n" In total, as multi-stage conversion Inputs, k^, 
kg, .... k„, and outputs data outputs, e^, eg, e^, whose length is V In total as decrypted data. 

30 [0025] In order to accomplish the above object, according to the twelfth aspect of the present invention, there is 
provided a converting method using: 

an "n" number of conversion functions, F|: AxA-^A (^^\^n), with respect to a domain A; 
a binary arithmetic operation, ^ : AxA-^A, and Its reverse binary arithmetic operation,® : AxA->A, wherein, 
35 for arbitrary x E A, y e A, conditions of 

(x^y)(o)y-x, and 

(>®y) * y-x 

are satisfied; and 
a predetemiined parameter, a e A, and 
40 the converting method comprising a generating step, a key accepting step, a repetition controlling step, a data 
accepting step, and a converting step, and characterized In that: 

the generating step includes accepting generated inputs, x^, Xg, x^eA, whose length is "n" in total, and 
generating generated outputs, y^, ya, yn £ A, whose length is "n" in total using recurrence fonnulas, 

45 

y^«Fi (Xi,a), 

and 

50 

yM = F^,^ (x^,i.y,)(l£l^n-1); 

the key accepting step includes accepting key Inputs, k^. kg. .... kn G A, whose length Is "n" In total, and giving 
55 the accepted key Inputs as generated inputs to the generating step; 

the repetition controlling step includes giving the generated outputs from the generating step as generated 
inputs to the generating step, for an ^m" (m>0) number of times, and setting one of the generated outputs to 
be given at end as a random number string, r^, rg r^ G A, whose length is "n" In total; 
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the data accepting step includes accepting data inputs, d^, dg, .... g A, whose length is "n" in total; and 
the converting step Includes converting data for any integers "i" in a range between 1 and "n" using a formula, 



and 

outputting data outputs, e^, eg, .... e^ e A, whose length is "n" In total. 

[0026] In order to accomplish the above object, according to the thirteenth aspect of the present Invention, there is 
provided a converting method using: 

an ••n" (n>1 ) number of conversion functions, Fj: AxA-^A (1<i^n), with respect to a domain A; 

a binary arfthmetic operation, ^: AxA->A, and Its reverse binary arithmetic operation,® : AxA-^A, wherein. 

for arbitrary x e A, y E A, conditions of 

(x^y)® y=x, and 

(j<§)y) ^ y-x 

are satisfied; and 
a predetemiined parameter, a E A, and 

the converting method comprising a generating step, a key accepting step, a repetition controlling step, a data 
accepting step, and a converting step, and characterized in that: 

the generating step includes accepting generated inputs, x^, Xg, x„ G A, whose length is "n" in total, and 
generating generated outputs, y^ , y2, y^ e A, whose length is "n" in total using recurrence fomiulas, 

yi = Fi (xi,a), 

and 



= P}4i (X|+i,Xj)(1:Si^n-1); 

the Icey accepting step Includes accepting Icey Inputs, k^. kg, k^, e A whose length is "n" in total, and giving 
the accepted key Inputs as generated Inputs to the generating step; 

the repetition controlling step includes giving the generated outputs from the generating step as generated 
inputs to the generating step, for an "m" (m>0) number of times, and setting one of the generated outputs to 
be given at end as a random number string, r^, rg, r^ G A, whose length Is "n" in total; 
the data accepting step Includes accepting data inputs, d^, dg. .., d^ e A, whose length Is "n" In total; and 
the converting step includes converting data for any integers "i" In a range between 1 and "n" using a formuia 



and 

outputting data outputs, e^, eg. e^ E A, whose length Is "n" in total. 

[00271 Each of the binary arithmetic operations® and ^ may be exclusive OR. 
[0028] In the converting method, 

at least one of the conversion functions F, defined by positive integers M, s, may satisfy following conditions, for 
an arbitrary integer parameter b (I^^M^). 



F, (X, b) = ceil (xM*/b) (1^x^b). 



and 



EP1 289186 A2 



F, (X, b) - floor (M* (x-by(M*-b)) + 1 (b<x<M'), 

in cases where: 

5 

"ceil (•)" represents that decimals should be rounded off to a next whole number In "M" number system; and 
•floor (•)" represents that decimals should be cut off in "M" number system. 

[0029] In the converting method, 
^0 at least one of the conversion functions F| defined by positive integers M, s, may satisfy following conditions, for 

an arbitrary Integer parameter, b (Kb^M^), 

Fi(y.b) = x^ {q<xi); 

IS 

F|(y. b)=: X2(Xi^q). 

where 

20 

x^ = floor (M''' by); 

2s Xa^ceil^MVljy + M*); 

q = b (X2-MV(b-M®), 

30 in cases where: 

"cell (•)" represents that decimals should be rounded off to a next whole number in "M" number system; and 
"floor (•)" represents that decimals should be cut off In "M" number system. 

35 [0030] In order to accomplish the above object, according to the fourteenth aspect of the present invention, there is 
provided a converting method using: 

an "n" (n^1) number of conversion functions, Fj: AxA^A, (1^i^n) and their reverse conversion functions, G;: 
AxA-^A, with respect to a domain A, wherein, for arbitrary x E A and ye A, conditions of 

40 

F( (G, (x,y), y) = x. 

and 

45 

Gi (F, (X, y),y) = x, 

are satisfied; 

50 a binary arithmetic operation, ^ : An-^A", and its reverse binary arithmetic operation, @ : A^^A", wherein, for 

arbitrary z e A", conditions of 
®z) = z, and 
® z)-z 
are satisfied; and 
55 a predetemr^ined parameter, a G A, and 

the converting method comprising a generating step, a data accepting step, a repetition controlling step, and a 
converting step, and characterized in that: 
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the generating step Includes accepting generated Inputs, x^, Xg. .... x^ e A, whose length is "n" In total, and 
generating generated outputs, y^. .... y„ G A, whose length is "n" in total using recurrence fonnulas. 

y^-F^ (Xi,a), 

and 



the data accepting step includes accepting data inputs, k^, kg k„ G A, whose length Is "n" in total, and 

giving the accepted data inputs as generated Inputs to the generating step; 

the repetition controlling step includes giving the generated outputs from the generating step as generated 
inputs to the generating step, for an "m" (m^O) number of times, and setting one of the generated outputs to 

be given at end as a random number string, , rg 6 A, whose length is "n" in total; and 

the converting step Includes applying a single-tenn arithmetic operation, i5r . to the random number string, r^, 
rg, r^ e A, to perfonn its data conversion, that is, 



and 

outputting data outputs, e^, eg. e^, whose length is "n" In total. 

[0031] In order to accomplish the above object, according to the fifteenth aspect of the present invention, there is 
provided a converting method using: 

an "n- (n>1) number of conversion functions, F,: AxA~>A (1<i<n), and their reverse conversion functions, G,: 
AxA->A, with respect to a domain A, wherein, for arbitrary x e A and y e A, conditions of 

Pi (Gi (x,y).y) = x, 



Gi (F| (x.y), y)«x, 

are satisfied; 

a binary arithmetic operation, ifr: A"-->An, and its reverse binary arithmetic operation, @ : An-^A", wherein, for 
arbitrary z E A", conditions of 

^ ((0) 2) = z, and 
© z) = z 
are satisfied; and 
a predetemiined parameter, a g A, and 

the converting method comprising a generating step, a data accepting step, a converting step, and a repetition 
controlling step, and characterized in that: 

the generating step includes accepting generated inputs, x^, Xg, x^GA, whose length is "n" in total, and 
generating generated outputs, y^, yg, .... y^ E A, whose length is "n" In total using recurrence fomiulas, 

y^=G^(Xi.a). 

and 
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the data accepting step includes accepting data Inputs, h^, E A, whose length Is "n** In total; 

s the converting step includes apptying a slngle-temn arlthnnetic operation, , to the data Inputs, h^ , h^, .... hn, 

to perfomn Its data conversion, that Is, 

to 

and 

giving results of the data conversion, v^. V2, Vp, to the generating step; and 
the repetition controlling step includes giving the generated outputs from the generating step as generated 
Inputs to the generating step, for an "m" {rr\>0) number of times, and setting one of the generated outputs to 
f 5 be given at end as data outputs, s^ , S2 6 A, whose length is "n" in total. 

[0032] In the above-described converting method, in cases where "A" represents a "f-number bit space, and "z G 
A"" corresponds to a bit string having "tn" bits in length, in the single-tenn arithmetic operation® , bits In the bit string 
may be shifted by a predetemfilned number of bits In a predetemnlned direction, and Its resultant bit string may be set 
20 to correspond to A", thereby obtaining a result of the single-temri arithmetic operation @ . 
[0033] In the converting method, 

at least one of the conversion functions Fj defined positive integers M, s, may satisfy following conditions, for an 
arbitrary integer parameter b (1^<M®), 

F, (X, b) = cell (xM^/b) (1 <x^b), 

and 

F, (x, b) = floor {M* (x-byCM^-b)) + 1 {b<x<M'), 

In cases where: 

35 "cell (•)" represents that decimals should be rounded off to a next whole number in "M" number system; and 
"floor (•)" represents that decimals should be cut off in "M" number system. 

[0034] In the converting method, 

at least one of the conversion functions F| defined by positive integers M, s, may satisfy following conditions, for 
40 an arbitrary integer parameter, b ('\<b<,W), 

F,(y,b) = Xi (q<x^); 



F,(y,b) = X2{x,^q), 

where 

x^ = floor (M"** by); 
X2 = ceil ({M'*b-1)y + M'); 

55 

q = b (X2-MV(b-M^), 
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In cases where: 



"ceil (.)" represents that decimals should be rounded off to a next whole number in "M" number system- and 
"floor (.)" represents that decimals should be cut off in '*M" number system. 

[0035] In order to accomplish the above object, according to the sixteenth aspect of the present invention there is 
provided a multi-stage converting method comprising: 

a "u" number of converting steps (a T-th converting step is called a converting step M. (I^ku)) of usinq the con- 
verting method according to claim 23; and 

a multi-stage key-input accepting step of accepting parameter Inputs 8^,82, a„ g A whose length Is "n" in total 
and setting a T-th parameter input, a^, included in the accepted parameter Inputs, as a predetermined paramete^ 
"a" of the converting step Mj, and wherein 

a converting step included in the "u" number of converting steps Includes accepting multi-stage conversion 
inputs, kz k„, whose length Is "n" in total, as data inputs. 

data outputs, which are output at a converting step M; (1 <j<u.1 ) included in the "u« number of converting steps 
are given to a converting step U^^ included In the "u^ number of converting steps, as data inputs, and 
a converting step included in the '*u" number of converting steps includes outputting data outputs e. 
e^, whose length is "n" In total, as multi-stage conversion outputs. ' 

[0036] In order to accomplish the above object, according to the seventeenth aspect of the present invention there 
IS provided a multi-stage converting method comprising: 

a "u" number of converting steps (a "J-'th converting step Is called a converting step M, (1^^u)) of using the con- 
verting method according to claim 24; and 

a mufti-stage l<ey-input accepting step of accepting parameter Inputs a^ . a^, a^, E A whose length Is "n* in total 
and setting a "jMh parameter Input, a,, included in the accepted parameter inputs, as a predetermined parameter 
a of the converting step Mj, and characterized In that 

a converting step Included in the "u" number of converting steps includes accepting multi-stage conversion 
inputs, hi, hn, whose length is "n" in total, as data inputs, 

data outputs, which are output at a converting step M^,^ (1 ^i<u-1 ) included in the "u" number of converting steps 
are given to a converting step fW, included in the "u" number of converting steps, as data Inputs, and 
a converting step included in the •'u" number of converting steps Includes outputting data outputs s. So 
s„, whose length Is "n" In total, as multi-stage conversion outputs. ' 

[0037] In order to accomplish the above object, according to the eighteenth aspect of the present invention there is 
provided a program for controlling a computer to serve as any of the above-described converters or any of the above- 
descnbed multi-stage converters, or a program for controlling a computer to execute any of the above-described con- 
verting methods or any of the above-described multi-stage converting methods. 

[0038] In order to accomplish the above object, according to the nineteenth aspect of the present Invention there Is 
provided an information recording medium recording any of the progmms. 

[0039] As the above-described infomiation recording medium, there may be employed a compact disk a flexible 
disk, a hard disk, a magneto-optteal disk, a digital video disk, a magnetic tape, and a semiconductor memory. 
[0040] Separately from the computer to be executing the program, the program of the present invention may be 
distributed or sold through a computer communication networic. In addition, separately from the computer to be exe- 
cuting the program, the information recording medium of the present invention may be distributed or sold through 
general business transactions, etc. 

[0041 ] The object and other objects and advantages of the present invention will become more apparent upon reading 
of the following detailed description and the accompanying drawings in which: 

FIG, 1 is an exemplary diagram showing the schematic structure of a converter according to the first embodiment 
of the present invention; 

FIG. 2 is a flowchart showing procedures of a conversion process whteh is can-ied out by a serial computer servina 

as the converter; 

FIG. 3 is an exemplary diagram showing the schematk; structure of a converter according to the second embod- 
iment of the present invention; 

FIG. 4 is a flowchart showing procedures of a conversion process whteh is carried out by a serial computer servina 
as the converter of FIG. 3; r- a 
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FIG. 5 Is an exemplary diagram showing the schematic structure of an encryption/decryption system including the 
converters respectively as an encrypting unit and a decrypting unit; 

FIG. 6 Is an exemplary diagram showing the schematic structure of an encryption/decryption system including the 
converters respectively as an encrypting unit and a decrypting unit; 
5 FIG. 7 is an exemplary diagram showing the schematic structure of a converter according to the fourth embodiment 

of the present invention; 

FIG, 8 is a flowchart showing procedures of a conversion process which is canried out by a serial computer serving 

as the converter of FIG. 7; 

FIG. 9 is an exemplary diagram showing the schematic structure of a converter according to the fifth embodiment 
10 of the present invention; 

FIG. 1 0 is a flowchart showing procedures of a conversion process which is carried out by a serial computer serving 
as the converter of FIG. 9; 

FIG. 1 1 is an exemplary diagram showing an encryption/decryption system including the converter as an encrypting 
unit and the converter as a decrypting unit; 
15 FIG. 12 is an exemplary diagram showing an encryption/decryption system including the converter as an encrypting 

unit and the converter as a decryption unit; 

FIG. 13 is an exemplary diagram showing the schematic structure of a multi-stage converter according to the 
seventh embodiment of the present invention; 

FIG. 1 4 is an exemplary diagram showing the schematic structure of a multi-stage converter according to the eighth 
20 embodiment of the present invention; 

FIG. 15 Is an exemplary diagram showing the schematic structure of an encryption/decryption system, according 
to the ninth embodiment of the present invention, including the multi-stage converters which are in a pair relation- 
ship with each other; 

FIG. 16 is an exemplary diagram showing the schematic structure of an encryption/decryption system, according 
25 to the tenth embodiment of the present invention, including the multi-stage converters which are in a pair relation- 

ship with each other; and 

FIG. 1 7 is a distribution diagram showing a distribution of data generated according to the technique of the present 

invention. 

30 [0042] Prefen-ed embodiments for practicing the present invention will now be described. Embodiments, as will be 
explained later, are to illustrate the present invention, not to limit the scope of the present invention. For those skilled 
in the art, the present invention may be applicable to embodiments including replaced elements equivalent to each or 
entire elements of the present invention, and such embodiments are, therefore, within the scope of the present inven- 
tion. 

35 [00431 the explanations below, a converter which can be adopted for an encryption system using a vector-stream 

private (secret) key will be described in each of the first and second embodiments of the present Invention, and an 
encryption/decryption system using either encryption system of the first and second embodiments will be described in 
the third embodiment of the present invention. 

[0044] In the preferred embodiments of the present Invention, with respect to a domain A, there are an "n" (n^1) 
40 number of conversion function(s) Fj: AxA-»A (1^l<n), a binaiy arithmetic operation iSr: AxA-^A, and its reverse binary 
arithmetic operation® : 

AXA^A. In this case, for arbitrary x G A and y e A, the conditions of: (x^r y) (§) y= x; and ()<o) y) iftr y= x should be 

satisfied. 

[0045] As such binary arithmetic operations® and , exclusive OR will be employed in the following embodiments, 
45 [0046] In the following explanations, "cell (•)" represents that decimals should be rounded off to the next whole number 
in "M" number system, and "floor (•)" represents that decimals should be cut off in "M* number system. 
[0047] In the following embodiments, at least one of conversion functions F, defined by positive integers M, s, and 
should satisfy the following conditions of: 

50 s 

F((x, b) = ceil (xM*/b) (1<x<b); 
F, (x. b) = floor (M* (x-b)/(M*-b)) + 1 (b<x^M*), 

55 

for an ariDitrary integer parameter b (1<b<Ms). This conversion function corresponds to Masuda-Aihara mapping with 
a parameter (lEICE Trans, on Communication. 1999, July. Vol. J82-A, No. 7, pp. 1042-1046). This mapping Is called 
also a skew tent mapping. 
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Where 



[00481 In thefollowingembodknents, instead of the above-described convereion functions F„ therecan be employed 
oiTiiTni'irj "^a^ 1 above-descnbed Masuda-Aihara n,applng with a parameter) which is defined by 
posrtwe integers M, s, and satisfies, for an aibitraiy Integer parameter b (1<bslM«). the following conditions of: 

F|(y.b) = x, (q<Xi); 
l'|{y.b) = X2(XiSq), 

X, = floor (M"* by); 
X2 = ceil((M"*b-1)y+M'); 

q = b(X2-M')/(b-M'). 

[0049] And In the following embodiments, Instead of the above-described conversion functions F„ there can be em- 
ployed a f unction whKh Is defined by positive integers M, s, is a second degree polynomial in x over module M^ and 
satisfies, for an arbitrary Integer parameter b (isb^) and a predefined function g of b, the following conditions of: 

F| (X, b) = 2x (X + g(b)) mod M*. 

^ '*^^^''^T^'y'''«9•^«•'°*'"9*eschematte8tructureof aconverteraccortl^ 

iment of the present Invention. 

[0051] A converter 1 01 uses a predetemiined parameter a G A. The converter 1 01 includes a generating unit 102 
a key accepting unit 103, a repetition controller 104, a data accepting unit 1 05, a converting unit 106 

[0052] The generating unit 1 02 receives generated inputs, x, , x^ x„ G A, whose length is "n" in total and 

mulas^^"^™^^^ generated outputs, y,. yj y„ e A. whose length is "n" in total, using the following reciirrence for- 

yi = F,(Xi.a); 

= F|+1 (Xi+i.yi) (1<i<n-1). 

SatSaSS^CC"'"^^^^^ K„eA,whoselength.V,andg.es.hegeneratlng 

SL o?^ ^'""^ ^^^"^ 9«"^rating unit 102 the generated outputs from the generating 

unit 102 as generated inputs, repeatedly for an "m» (mso) number of times. In this case, the generated outouts to be 

given at the end is a random number string, r^ , rj r„ e A, whose length is "n" in total 

rS l^f '^^'^ ^^Piir^a unit 105 accepts data inputs, d,. d„ e A. whose length Is "n" In total. 

the foLL ^•'"verting unit 106 perfomis data com/erslon for any integer(8) T in a range between 1 and "n", using 

ei = di*ri, 

so as to output data outputs, e^, eg £ A. whose length is "n" in total 

[0057] This calculation (data conversion) can be executed at high speed by a parallel computer having a pipeline 
Si coSr"' '"'"""""^ explanations, the above calculation Is to be executed by a general^-used 
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[0058] FIG. 2 is a flowchart for explaining a conversion process which is carried out by a serial computer serving as 
the converter 1 01 . 

[0059] The converter 101 accepts key input variables, k^, k^ G A (Step S201). 

[0060J The converter 1 01 substitutes the accepted variables respectively for variables , .. . . G A (Step S202). 
5 [0061 ] After this, the converter 1 01 substitutes a value "m" for a counter variable "c" (Step S203). 

[00621 Further, the converter 1 01 calculates variables, y^, yg, . .. yn ^ A (Step S204), using the following recun^ence 
formulas: 

yi-F,(x,.a): 

yM = ^M (x,^i^y,)(1^i<n-1), 

15 [0(^3] The converter 101 checkswhetherthecountervariable Vis 0 (Step S205). Inthecasewhere Itis detennined 
that the counter variable "c" is not 0 (Step S205; No), the converter 1 01 substitutes the variables, y^, yg, .... yn for the 
variables Xi.Xg, .... x^ (Step S206). After this, the converter 101 decrements the counter variable "c" by 1 {StepS207), 
and the flow returns to the procedure of the step S204. 

[0064] In the case where it is detenmined that the counter variable "c" Is 0 (Step S205; Yes), the converter 101 
20 substitutes the variables, y^, ya, . yn variables r^, rg, r^ G A (Step 8208). 

[0065] The converter 101 accepts target data inputs, d^, dg, d„ G A to be encrypted (Step S209). 

[0066] The converter 101 perfoms data conversion for any Integer(s) "i" in a range between 1 and "n", using the 

formula 

ei-diTi^rj(StepS210). 
[0067] Finally, the converter 101 outputs variables, e^, eg, e„ (Step 8211). 

[0068] By the above-described processes, the conversion process to be adopted in the encryption/decryption system 

30 of the present invention will be realized. 

[0069] FIG. 3 is an exemplary diagram showing the schematic structure of a converter according to the second 
embodiment of the present invention. The converter according to this embodiment will now specifically be explained 
with reference to FIG. 3. 

[0070] A converter 301 has the structure which is substantially the same as the structure of the converter 1 01 . The 
35 converter 301 has a generating unit 302 con-esponding to the generating unit 102, a key accepting unit 303 corre- 
sponding to the key accepting unit 1 03, a repetition controller 304 corresponding to the repetition controller 1 04, a data 
accepting unit 305 con-esponding to the data accepting unit 105, and a converting unit 306 corresponding to the con- 
verting unit 106. 

[0071] The generating unit 302 uses recurrence fomnulas which are different from the recurrence fomnulas used by 
40 the generating unit 1 02. Specifically, the generating unit 302 uses recurrence fonnulas: 

yi = Fi (Xi,a); 

y^.i = F,.i(XM,x,)(1^i^n>1). 

[0072] FIG. 4 is a flowchart for explaining a conversion process which is carried out by a serial computer serving as 
the converter 301 , The procedures of the conversion process which are perfonned by the converter 301 are substantially 

50 the same as those of conversion process perfonned by the converter 1 01 , and the procedures of the steps S401 to 
S411 to be executed by the converter 301 respectively correspond to the procedures of the steps 8201 to 8211 to be 
executed by the converter 101. 

[0073] The recurrence formulas used In the step S404 differ from the recurrence fomnulas used in the step S204. 
That is, in the step S404. the converter 301 uses the recurrence fomnulas: 

55 

yi = Fi(Xi.a); 
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y^i^Pki (>fi+i.x,) (1<i^n-1). 

[0074] An encryption/decr/ption system according to the third embodiment of the present Invention includes either 
the converter 1 01 or the converter 301 as an encrypting unit, and further Includes the same as a decrypting unit 
[0075] FIG. 5 is an exemplary diagram showing the schematic structure of the encryption/decryption system Including 
two converters 101 serving as the encrypting unit and a decrypting unit, 

[0076] An encryption/decryption system 501 includes an encrypting unit 502 and a decrypting unit 503. Each of the 
encrypting unit 502 and the decrypting unit 503 includes the converter 1 01 . 

[0077] The encrypting unit502 and the decrypting unit 503 use the same and "a". In this embodiment, the symbols 
@ and ^ express the function of gxcIusIvg OR, so that a condition of x if y - )<§) y should bo satisfied, for arbitrary 
X G A, y e A. ' y 

[0078] Each of the encrypting unit 502 and the decrypting unit 503 accepts the common key inputs, , kg, . , k-. 
[0079] The encrypting unit 502 accepts original data whose length is "n" In total, as data inputs, and outputs data 
outputs whose length Is "n" in total, as encrypted data. 

[0080] The decrypting unit 503 accepts the encoded data, whose length is "n" in length, as data inputs, and outputs 
data outputs, whose length is "n" in total, as decoded data. 

[0081] In this manner, a vector-stream private key encryption system can thus be realized. 
[W)82] FIG. 6 Is an exemplary diagram showing the schematic stmcture of an encryption/decryption system Including 
two converters 301 which serve as an encrypting unit and a decrypting unit. In this embodiment also, the encryption/ 
decryption system 501 Includes the encrypting unit 502 and the decrypting unit 503. Except that the each of the en- 
crypting unit 502 and the decrypting unit 603 Includes the converter 301. the encryption/decryption system 501 has 
the same structure as that of FIG. 5. 

[0083] According to this embodiment also, a vector-stream private key encryption system can be realized. 
[0084] I n the explanations below, a converter which can be adopted for a vector-stream private key encryption system 
will be described In each of the fourth and fifth embodiments of the present Invention, and an encryption/decryption 
system using either encryption system of the fourth and fifth embodiments will be described in the sixth embodiment 
of the present invention. 

[0085] In the explanations below, there are employed an -n« (1 $n) numberof conversion functions F,: A x A^A (1 ^i<n) 
and their reverse conversion functions Gji AxA-^A, for a domain A. For artjitrary x e A. y e A, the conditions of: 

P| (Gi (x,y).y) = x; 
G|(F,(x.y),y)-x 

should be satisfied. 

[0086] A single-term arithmetic operation : AH-^A" and its reverse singie-tenn arithmetic operation @ • A^-^A" 
are adopted below. In temis of these arithmetic operations, for arbitrary z G A" the following conditions of- 

* ®z)-z; 

® (* z) = z 
should be satisfied. 

[0087] Partteularly. In the following explanations, in the case where "A" represents a "t"-number bit space and "z 6 

A"" corresponds to a bit string having In" bits In length, in the single-term arithmetic operation @ , bits in the bit string 

are cyclically shifted by a predetermined number of bits in a predetemiined direction. After this, the resultant bit string 

Is set to correspond to A", thereby obtaining a result of the single-temi arithmetic operation. 

[0088] In the following description, "ceil (♦)" represents that decimals should be rounded off to the next whole number 

in -M- number system, and "floor (.)" represents that decimals should be cut off In "M" number system. 

[0089] In the following embodiments, at least one of conversion functions F, defined by positive integers M s and 

should satisfy the following conditions of: ' ' 



F, (X, b)=:CGH (xM*/b)(1<x^b); 

55 

F, (X. b) = floor (M^ (x-b)/(M^b)) + 1 (b<x<M'*), 
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for an arbitrary Integer parameter b (1 <b<M*). This at least one conversion function corresponds to the above-described 
Masuda-Aihara mapping with a parameter. 

[0090] In thefoilowing embodiments, instead of the above-described conversion functions Fj, there can be employed 
a function (reverse mapping of the above-described Masuda-Aihara mapping with a parameter) which is defined by 
positive integers M, s, and satisfies, for an arbitrary integer parameter b (I^^M*), the following conditions of: 

F| (y.b)-x^ (q<x^); 
F,(y. b) = X2 (x^^q), 

where 

floor (M'** by); 
X2 = cell ((M"Vl)y + M*); 
q = b (X2-M>(b-M^). 

[0091] FIG. 7 is an exemplary diagram showing the schematic structure of a converter according to the fourth em- 
bodiment of the present invention. 

[0092] A converter 701 uses a predetenmlned parameter a G A. The converter 701 includes a generating unit 702. 
a data accepting unit 703, a repetition controller 704, and a converter 705. 

[0093] The generating unit 702 accepts generated inputs, x^, Xg, .... x^ G A, whose length Is "n" In total, and outputs 
generated outputs, y^, yg, y^ e A. whose length is "n" in total, using the following recurrence fonnulas: 

Vi -F^ (Xi.a); 

Vm^f'"' (x^i,y,){1^l5n-1). 

[0094] The data accepting unit 703 accepts data inputs, k^, k^ S A, whose length is "n" in total, and gives the 
accepted data inputs to the generating unit 702. 

[0095] The repetition controller 704 gives back the generating unit 702 the generated outputs sent from the generating 
unit 1 02 as generated Inputs, repeatedly for an "m" (m^) number of times, in this case, the generated output to be 
given at the end is a random number string, r^, r2, .... r^ G A, whose length is "n" in total. 

[0096] The converting unit 705 applies a single-temrt arithmetic operation tothe random number string, r^, r2, .... 
rj, E A. to perform its data conversion, that is, 

(cj, 62, = TJr(r|, rj, 

so as to output data outputs, e^, eg, Op, whose length is "n" in total. 
[0097] The arlthmette operation can be accomplished at high speed by a parallel computer having a pipeline process 
function, and can be accomplished also by a general serial computer. 

[(K)98] FIG. 8 is a flowchart for explaining a conversion process which Is carried out by a serial computer serving as 
the converter 701 . 

[0099] The converter 701 accepts data inputs, ki, kg, .... G A, whose length Is "n" in total (Step S801). 

[0100] The converter 701 substitutes the accepted data Inputs respectively for x^, Xg x^ G A (Step S802). 

[0101] After this, the converter 701 substitutes a value "m" for the counter variable "c" (Step S803). 

[0102] Then, the converter 701 cateulates the variables y^.yg, ....ynGA(StepS804),usingtherecurrencefonnulas: 
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y^-F^ (xi,a); 

[0103] Theconverter701checkswhetherthecountervariableVisO{StepS805)Jnthecasewhereitisd 
that the counter variable "c" is not 0 (Step S805; No), the converter 701 substitutes the variables, y^, yg, ... y^, respec- 
tively for the variables x^, Xg x„ (Step 8806), and decrements the counter variable "c" by one (Step 5807)' and the 

flow returns to the procedure of the step 8804. 

[0104] In the case where the counter variable "c" is 0 (Step 8806; Yes), the converter 701 substitutes the variables 
yi . y2. . yn respectively for the variables r^, rg, r^, G A (Step S808). 

[0105] The converter 701 uses a single-term arithmetic operation ^ for the variables, r., r,, r„ G A, to perform 
its data conversion, that Is, 

(e|,ei,...,e^« *(r„r2, ...,rj. 
[0106] Finally, the converter 701 outputs the variables, e^, eg (Step S810). 

[0107] FIG, 9 Is an exemplaiy diagram showing the schematic structure of a converter which is in a pair relationship 
with the above-described converter 701 . 

[0108] Aconverter901 according to the fifth embodiment ofthe present invention use the same arithmetic operations, 
functions, parameters, like "F,", "G,", @ , , "a", "m", as those used by the converter 701 . 

[0109] The converter 901 uses a parameter "a". The converter 901 includes a generating unit 902, a data accepting 
unit 903, a converting unit 904, and a repetition controller 905. 

[0110] The generating unrt 902 accepts generated inputs, x^, Xg x„ E A, whose length is "n" In total, and outputs 

generated outputs, y^, yg y^ 6 A whose length is "n" In total, using the following recurrence fomiulas: 

yi = Gi (x^.a); 

Ym^Gm (Xm.X|) (1^i^n-1). 
[0111] The data accepting unit 903 accepts data inputs, h^, hg, h^ e A. 

[01 12] The converting unit 906 uses a single-term arithmetic operation ® for the data Inputs, h. , h, h G A to 

perfonn its data conversion, that is, > ^' - n 

(Vi.Vg, .... v„)==®{h^.h2 Kl 

and 

gives the generating unit 902 the results (v^, V2, v^ of the converBion. 
[01 13] The repetition controller 905 gives back the generating u n it 902 the generated outputs sent from the generating 
unit 902 as generated inputs, repeatedly for an "m" (m^rO) number of times. In this case, the generated outputs to be 
given at the end are data outputs, s^, s^, .... s^ G A, whose length is "n" in total. 

[01 14] This calculation (data conversion) can be executed at high speed by a parallel computer having a pipeline 
process function. However, the above calculation may be executed by a generally-used serial computer. 
[01 15] FIG. 10 Is a flowchart for explaining a conversion process which Is can-led out by a serial computer serving 
as the converter 901. 

[0116] The converter 901 accepts data inputs, hi, hg. .... h„ g A, whose length is "n" In total (Step SI 001). 
[0117] The converter 901 uses a single-term arithmetic operation® for the data inputs, hn. ho, ... h- so as to 
perfonn data conversion (Step SI 002), that is, 

(Vi.V2,...,v„)=®{hi.h2 h„). 

[0118] The converter 901 substitutes variables, v^, Vg. v^ respectively for x^, X2, x„ G A (Step S1003). 
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[0119] The converter 901 substitutes a value "m" for the counter variable (Step S1004). 

[0120] Further, the converter 901 calculates the variables, y^, yg. ...» yn ^ A (Step SI 005), using the recun^ence 

formulas: 

y^ -G^ (x^,a); 



10 

[0121 J The converter 901 checks whether the counter variable is 0 (Step SI 006). In the case where It Is deter- 
mined that the counter variable "C" is not 0 (Step S1006; No), the converter 901 substitutes the variables, y^ , y2, .... 
y^ respectively for the variables, x^, Xg, x^ (Step S1007), and decrements the counter value "C" by one (Step S1 008), 
and the flow returns to the procedure of the step S1 005. 
15 [0122] On the contrary, in the case where it is detennined that the counter variable "C is 0 (Step S1 006; Yes), the 

converter 901 substitutes the variables, y^, yg yn respectively for the variables, s^, Sj, s^, G A (Step S109), 

[0123J Finally, the converter 901 outputs the variables, s^, Sg, .... s^ (Step S1010). 

[01 24] Explanations will now be made to an encryption/decryption system including the above-described converters 
701 and 901 which are In a pair relationship with each other. Either the converter 701 or the converter 901 is used as 
20 an encrypting unit, and the other one is used as a decrypting unit, so that there are two different types of systems In 
accordance with the combination of the two. 

[01 25] FIG. 1 1 is an exemplary diagram showing the schematic structure of the encryption/decryption system inciud- 
ing both the converter 701 as the encrypting unit and the converter 901 as the decrypting unit 
[0126] An encryption/decryption system 1101 according to the sixth embodiment of the present invention Includes 
25 an encrypting unit 1 1 02 and a decrypting unit 11 03. The encrypting unit 1 1 02 includes the above-described converter 
701 , while the decrypting unit 11 03 includes the converter 901 which is in a pair relationship with the converter 701 . 
[0127] The encrypting unit 1103 accepts original data, as data Inputs, kq, kp, whose length is "n" in total, and 
outputs data outputs, e^, eg, e,,, whose length is "n" in total, as encrypted data. 

[0128] The decrypting unit 1104 accepts the encrypted data whose length is "n" in total, as data inputs, h.j, .... 
30 hn, and outputs data outputs, s^, S2, .... s^,, whose length is "n" in total, as decrypted data. 

[0129] According to this structure, the vector-stream private key encrypting system can be realized. 

[0130] FIG. 12 is an exemplary diagram showing the schematic structure of an encrypting/decryption system 1 201 , 

Including the converter 901 serving as an encrypting unit and the converter 701 serving as a decrypting unit. 

[0131] The encrypting/decryption system 1201 includes an encrypting unit 1202 and a decrypting unit 1203. The 
35 encrypting unit 1 202 includes the above-described converter 901 , while the decrypting unit 1 203 includes the converter 

701 which is in a pair relationship with the converter 901 . 

[0132] The encrypting unit 1202 accepts original data, as data inputs, hi. hg, hp, whose length is "n" in total, and 
outputs data outputs s^, Sg, s^ whose length is "n" in total, as encrypted data, 

[0133] The decrypting unit 1203 accepts the encrypted data whose length is "n" as data Inputs, k^, kg, .... k„, and 
40 outputs data outputs, e^, .... e^, whose length is "n" in total as decrypted data. 

[01 34] Likewise the above, according to this embodiment as well , a vector-stream private key encrypting system can 

be realized. 

[0135] The single-term arithmetic operations (g) and ^ adopted in the fourth to sixth embodiments of the present 
invention will now exemplarily described. In the case where "A" represents one bit space and "z G A"" corresponds to 
45 a bit string having "n" bits in length, in the slngle-temi arithmetic operation @ , the following speclfte calculation can 
be employed 

22 2a-V Zp) = (^a ^n* ^1' ^2. - ^a-l)' 

SO 

[01 36] This is an "a-1 "bit(s) circulation (cyclical shift) arithmetic operation (can also be called "n-a+l " b{t(s) circulation 
arithmetic operation). In terms of the arithmetic operation , there can be employed the opposite bit circulation arith- 
metic operation for shifting bits in the bit string in the opposite direction to that in the case of the arithmetic operation 
@ . An example of this is 

55 

■#r (2^ ...» Zb, Zj, Z2, ...» Z^i) ^ (Zjj Z2, ...» 3Vl> ^5 ^n). 
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[01 37] Even in the case where A is t (t>1 ), such a bit cimulatlon arithmetic operation car. spontaneousiy be expanded 
and can be adopted for the present invention. i«"wiK,iyDeexpanaea, 

Sufi '''\!°!'°*'"? explanations, a multi-stage converter, Including the converter 701 and the converter 901 in 
muft -stag^ Which sre In a pair relation with each other, will be desaibed in each of the seventh and eS embod" 

tnthTrtisr^^^^ 

h!v I ^"If '""",'■'^9^ «"~«*er 1301 includes a V number of converters 701 (the "J"-th converter is called M 
(1 <jsu)) and a multi-stage key-input accepting unit 1 302. i -J in converter is called Mj 

?^.V} , "'"'t'-«tag« ksy-input accepting unit 1302 accepts parameter inputs, a,, a, a e A whose Isnath fe 

ml^, IT ^^^^'^^^ ^^^^^ murtl-stage converelon inputs, k,. k„. as data Inputs. 

is dti inputr """""'^'^ **• <^^"-^> ^ fll*^ 701 M^,. 

Ks.^'""'"''"''*'''"'''''''"*"^'^""*"^'"''^ e„. whose length isVin total, asmultl^geconverskjn 

[0145] FIG 14 is an exemplary diagram showing the schematic structure of a multi-stage converter 1401 whteh Is 
in a pair relationship with the above-described multi-stage converter 1 301 "^nvener i <mi which Is 

[0146] The multi-stage converter 1401 Includes a "u" number of converters 901 (the T-th converter Is called N. 
(1 sj<u)), and a multi-stage key-input accepting unit 1402. * J convener is canea N, 

[0147] The multi-stage key-input accepting unit 1402 accepts parameter Inouts a, a a p a whn=» 

tH ^ -Xlet^ nput aj :S a pr^^^^i; 
rameter of the corresponding converter 901 Nj p I a5> a pi eueierminea pa 

dala iJpuS' '"P"'^' "^"^ " total, as 

fsSl inpute' "'^ f'^*^-^' «™ a^^^" the converter 901 N, , 

Ss. ■^"'^"^"""'^^ outputsdata outputs, s„ s, s„, whose length "n" In total, as multi-stage conversion 

Knn^^^' ? ^ exs^lafy diagram showing the schematte stoicture of an encryption/decryption system 1501 

[0152] The encryptionydecryptlon system 1501 includestheabove-descrlbedmulti-stageconverterlSOl servinaas 
an e crypting unj 1502 and the above-descr«,ed multi-stage converter 1401 . serving a' a decrypCnit TsT 
KiS tI; " * "'^® .^~'™"°"'y"^''y*eencwtingunit1502andthedecryptingunlt1503 
So3 "''"^'"^■'^ ««.«'««'^'™'nly accepted by the encrypting unlt1502 and the decn^ting 

ff ,?f ^"^'yP''"9 ""it 1502 accepts original data as multi-stage conversion Inputs, k, k, k whose lenoth 

Si J''.!''?T^^""''''°'^'="^P'^''^««"=Wted data as multi-stage «^^^^ h wh^ 

length is n" In total, and outputs multi-stage conve^ion outputs, s.s^ 8, whose length teV In to^ as d^^ 

mifm *° ^ vector-stream private key enc^ptlon system can be realfeed. 

nrtuIL t^' I °r ^''^P^^'y ^'^a^^'" «'^°'^i"9 the schematic stoicture of an enciyption/decryplion system 1601 

iSnssrrar^^^^^^^^^ 

[0159] The encryption/decwtlon system 1601 Includes the above-described multi-stage 5 converter 1401 as an 
encrypting umt 1602 and the above-descrtoed multi-stage converter 1301 as a decrypting unit 1 603 
ni«! tI; " 9 r "S"* the encrypting unit 1602 and the decrypting unit 1 603 

fJgunitllSr ""^'"'■"^ «u.arecommonly accepted by the encrypting unlt01602andthe decypt- 

(0162J The encrypting unit 1 602 accepts original data as multi-stage conversion Inputs, h,. h, h whose lenath 

E . T '. T> T'"^ a«:epts the encrypted data as multi-stage conversion inputs k! kf 7' 
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[01641 According to this embodiment also, a vector-stream pHvate key encryption system can be realized. 
[01651 in the vector-stream private l<ey encryption system, the computation parallelism ) thereof is enhanced, If the 
dimension number "n" is set large. Hence, with the utilization of an FPGA (Field Programmable Gate Array), etcher 
with the structure suitable for parallel processing using a dedicated chip, etc., high-speed processing may be further 
sxoected 

[01 661 Likewise the disclosure of Patent No. 3030341 and Unexamined Japanese Patent Application KOKAI Publi- 
cation No 200M75168, when the basic conversion of the present invention has an equal distribution, it also results 
in an equal distribution of the multi-dimensional vector(s) in the synthetic conversion of the present conversion. 
[01 67] FIG. 1 7 is shows a data distribution of data generated by a three-dimensional vector-stream private key en- 
cryption system, in a cube [0, 1]^. 

[01681 As seen from FIG. 1 7. it is obvious that data Is equally distributed in the cube. 

[01691 In the encryption process, the statistical stability, like an equal frequency characteristic, Is required. As obvious 
from FIG. 17, according to the technique of the present Invention, the data distribution shows the equal frequency 
characteristic 

[01 701 The system of the present Invention can be realized by a general computer, without the need for a dedtoated 
system A program and data for controlling a computer to execute the above-described processes may be recorded 
on a medium (a floppy disk, CD-ROM, DVD or the like) and distributed, and the program may be Installed into the 
computer and run on an OS (Operating System) to execute the above-described processes, thereby achieving the 
system of the present invention. The above program and data may be stored In a disk device or the like m the sen/er 
device on the Internet, and embedded in a carrier wave. The program and data embedded in the carrier wave may be 
downloaded into the computer so as to realize the system of the present invention. 

[0171 ] Various embodiments and changes may be made thereonto without departing from the broad spirit and scope 
of the invention The above-described embodiments are intended to Illustrate the present invention, not to limit the 
scope of the present invention. The scope of the present invention is shown by the attached clalnos rather than the 
embodiments. Various modifications made within the meaning of an equivalent of the claims of the Invention and within 
the claims are to be regarded to be In the scope of the present Invention. 



Claims 

1. A converter (101) using: 

an "n- (n>1) number of conversion functions, F,: AxA->A (1<i<n). with respect to a domain A; 
a binary arithmetic operation, "tx : AxA-^A, and its reverse binary arithmetic operation. @ : Ax A-^A, wherein, 
for arbitrary x E A, y G A. conditions of 

(x^y)(o)y-x, and 
()<o)y) * y=x 
are satisfied; and 

a predetemnined parameter, a G A, and . „ n^ 

said converter (1 01 ) characterized by comprising a generating unit (1 02), a key accepting unrt (1 03). a rep- 
etition controller (104). a data accepting unit (105). and a converting unit (106), and being characterized In 
that: 

said generating unit (102) accepts generated inputs, x^. Xg, . .. x^ G A, whose length Is "n" In total, and 
generates generated outputs, y^. yg. .... yn G A. whose length Is "n" In total using recurrence fomnulas 

yi = F^ (Xi.a), 

and 

yM = FM(XM.yi) (1^i^n-1); 

said key accepting unit (103) accepts key inputs, k^, kg. .... k„ G A. whose length is "n" in total, and gives 
the accepted key Inputs as generated inputs to said generating unit (102); 

said repetition controller (1 04) gives the generated outputs from said generating unit (1 02) as generated 
inputs to said generating unit, for an "m" (m^O) number of times, and sets one of the generated outputs 
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to be given at end as a randonn number string. r„ r, e A, whose length Is in totaf- 

said data accepting unrt (105) accepts data inputs. d„ d^. d„ E A, whose length is "n" In total; and 
said converting unit (106) converts data for any integers "i" In a range between 1 and «n« using a fonnula 

ei = di*ri, 

and 

outputs data outputs, e^, e„ e A, whose length is "n" in total. 

2. A converter (301) using: 

an "n- (n>1 ) number of conversion functions, F,: AxAh^A (1^l5n). with respect to a domain A- 
a binary arithmetic operation, ^: AxA-^A, and its reverse binary arithmetic operation,® : AxA-^A and said 
converter (301) being characterized In that. ^ axa-^a. and said 

for arbitrary x G A, y 6 A, conditions of 

(x-sSr y)(o)y-x, and 
(>® y) * y= X 
are satisfied; and 
a predetermined parameter, a e A, and 

l^i^''ZT' ^^"^P"s^"g a generating unit (302), a key accepting unit (303), a repetition controller 
(304), a data accepting unit (305), and a converting unit (306), and ^ 

characterized that: 

smd generating unft (302) accepts generated Inputs, x„ Xg. x„ e A. whose length is V In total, and gen- 
erates generated outputs. y„ y^ y„ s A, whose length Is "n" In total using recurrence fomiulas, 

and 

yM'^^M (X|4.i.X|)(1<l^n-1); 

If^J^^LTT''^. ^"^^^'^ '"P"'"' ^^^^ ^^^^^ ^^"9^ "n" total, and gives the 

accepted key inputs as generated inputs to said generating unit (302)- 

said repetition controller (304) gives the generated outputs from said generating unit (302) as generated Inputs 
to sa,d generating unit, for an "m" (m^O) number of times, and sets one of the generated oujuts to be given 
at end as a random number string, r^, r^. ... r, e A. whose length is «n" in total- 
said data accepting unit (306) accepts data inputs, d„ dg d„ G A. whose length is «n^ in total; and 

said converting unit (306) converts data for any Integers T In a range between 1 and "n" using a fomiula 

and 

outputs data outputs, e^, e^ E A, whose length is "n" In total. 

The converter according to claim 1 , characterized in that 

each of the binaiy arithmetic operations® and * is exclusive OR. 

The converter according to claim 1 , characterized In that 

for «nthrl'"! °^ conversion functions F, defined by positive integers M. s, satisfies following conditions, 
for an arbitrary integer parameter b (1^l\4s), ^ ' 



23 



EP 1 289 186 A2 



F,(x,b) = ceil(xM'/b)(1<x<b), 

and 

F, (X, b) = floor (M* {x-b)/(M'-b)) + 1 {b<x:SM'), 

in cases where: 

-ceil (.)" represents that decimals should be rounded off to a next whole number in "M" number system; and 
"floor represents that decimals should be cut off In "M" number system. 

5. The converter according to claim 1 , characterized In that 

at least one of the conversion functions Fj defined by positive integers M. s, and satisfies following conditions, 
for an arbitrary integer parameter, b (1<b^M'*), 

F|(y. b) = xi (q<Xi); 

Fi(y, b) = x2(x^^q), 

where 

x^ = floor (M'® by); 
X2 = ceil ((M'*b-1)y + M*); 
q = b(X2-M')/(b-M% 

In cases where; 

"cell (•)•* represents that decimals should be rounded off to a next whole number In "M" number system; and 
'lloor (.)" represents that decimals should be cut off in "M" number system. 

6. An encryption/decryption system (501 ) including the converter according to claim 1 or 2 as an encrypting unit (502) 
and another converter having a same structure of a structure of the converter according to claim 1 or 2 as a 
decrypting unit (503), and 

characterized In that: 

"F,", \ and "a", are commonly used by said encrypting unit and said decrypting unit; 
a condition, x 'fr y = )® y, is satisfied for an arbitrary x e A and y G A; 

said encrypting unit (502) and said decrypting unit (603) commonly accept Icey inputs, k^, ka. .... k^; 

said encrypting unit (502) accepts original data whose length is "n", as a data input, and outputs a data output 
whose length is "n" as encrypted data; and 

said decrypting unit (503) accepts the encrypted data whose length is "n", as a data input, and outputs a data 
output whose length is "n" as decrypted data. 

7. A converter using: 
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TxLT^^hT^I conversion functions F,: AxA-^A (1sisn) and their reverse conversion functions G,: 
AXA-^A. with respect to a domain A, wherein, for arbitrary x e A and y e A, conditions of 

Fi(G,(x.y).y) = x, 



and 



S| (F,{x,y),y) = x, 

are satisfied; 

f^r^ZaTzT^^ZSnst, ^ ''''''' '"""^ ® = 

(®z) = z, and 

® = z 

are satisfied; and 
a predetermined parameter, a £ A, and 

^Irlnf '"P"^- ^ '"'^"^^ '^"9*^^ and generates 

generated outputs, y,, yj y„ e A, whose length is "n" in total using recurrence formuias 

yi=Fi(Xi.a), 

and 



Vw'^w (Xm.Vi) (isisn-l); 

~HHT''""r"^''''P'''^''' '"P"*'' ^"^ ^' Whose length Is Vin total, and gives the 

accepted data inputs as generated inputs to said generating unit- a ««in8 

generating unit, for an "m" (m^O) number of times, and sets one of the generated outputs to be given at 
end as a random number string, r,. r„ G A, whose length is "n" in total; and 

T^VT.^SrTJ^^^^^^"^'^'^'^ 

r„ G A. to perfonn rts data conversion, that is, ^ ^ 



and 

outputs data outputs, e^, e^, 6„. whose length is «n" In total. 
A converter using: 

AvA " (f ^) """"^f f~"version functions. F,: AXA-.A (1<i^n), and their reverse conversion functions G,- 
AXA-»A, wrth respect to a domain A. wherein, for arbitrary x g A and y e A. conditions of 



Fi(G,(x,y),y) = x, 

and 
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Gi (F, (x,y),y) = x, 

are satisfied; 

a binary arithmetic operation, ix: A^^-^A", and its reverse binary arithmetic operation, © : A"-»A". wherein, 
for arbitrary z e A", conditions of 
(® z) = z. and 

are satisfied; and 
a predetennined parameter, a E A, and 

said converter comprising a generating unit, a data accepting unit, a converting unit, and a repetition controller, 
and characterized In that: 

said generating unit accepts generated Inputs, x^, Xg x„ e A. whose length is "n" in total, and generates 

generated outputs, yt, yg yn ^ A, whose length is "n" in total using recurrence formulas, 

yi-Gi (Xi.a), 

and 

yM=G|+i (Xi+i.x,) (1^i^n-1); 

said data accepting unit accepts data inputs, h^, hg, .... h„ E A, whose length is "n" in total; 

said converting unit applies a single-temi arithmetic operation, , to the data inputs, h^, hg, .... K, to 

perform Its data conversion, that is, 

(v„ Vj, vj= "3ftr(h„h2, -.,hj, 

and 

gives results of the data conversion, Vi, V2, Vn, to said generating unit; and 
said repetition controller gives the generated outputs from said generating unit as generated inputs to said 
generating unit, for an "m" (m^) number of times, and sets one of the generated outputs to be given at 
end as data outputs, s^ Sg Sp E A, whose length is "n" in total. 

9. The converter according to claim 7, characterized in that 

in cases where "A" represents a "f'-number bit space, and "z G A"" con-esponds to a bit string having "tn" 
bite in length, in the single-temi arithmetic operation® , bits in the bit string are shifted by a predetennined number 
of bits In a predetermined direction, and its resultant bit string is set to con-espond to A", thereby obtaining a result 
of the single-temn arithmetic operation® . 

10. The converter according to claim 7, characterized In that 

at least one of the conversion functions, F|. defined by positive integers M, s, satisfies following conditions, 
for an artDitrary integer parameter b (1^<M5), 

F,{x, b) = ceil (xM^/b) (1<x5b), 



Fj (X, b) = floor (M* {x-by{M''-b)) + 1 (b<x^M*), 

in cases where: 

"ceil {•)" represents that decimals should be rounded off to a next whole number in "M" number system; and 
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"floor (■)" represents that decimals should be cut off in "M" number system. 

1 1 . The converter according to claim 7, characterized In that 

for an in?^*"^ conversion functions. F,. defined by posith^e Integers M, s, satisfies following conditions 

tor an arbitrary integer parameter, b (1 ^»sM»), 

Fi(y. b) = x, (q<x,); 
F|(y.b) = X2(x,Sq). 

where 

X, = floor (IW* by); 
X2 = cell((IM"*b-1)y + M*); 

q = b (X2-M')/(b-M^), 

in cases where: 

•ceil (•)" represents that decimals should be rounded off to a next whole number in "IM" number svstem- and 
"floor (.)" represents that decimals should be cut off in "M" number system. ^ ' 

12. An encryption/decryption system including the converter according to claim 7 as an encrypting unit and the con- 
verter according to claim 8 as a decrypting unit, and crypungunii ana me con- 
characterized In that: 

■F,", "G,", ", and "a", are commonly used by said encrypting unit and said decivptinq unif 

data outputs, e,, Bj, ..„ e„. whose length Is "n" In total as encrypted data; and 

said decrypting unit accepts the encrypted data whose length is "n" In total, as data Inputs, h, h, h and 
outputs data outputs, s,. 8„. whose length is "n- in total as decrypted data. " ^ 

13. An encryption/decryption system Including the converter according to claim 8 as an encrypting unit and the con- 
verier according to daim 7 as a decrypting unit, and crypnng unit and the con- 
characterized In that: 

"F", "G|", " * ", 'l® and "a" are commonly used by said encrypting unit and said decivptinq unlf 

Sa ouZl",' "T"^ ortglnal data as data inputs, h,. h, h„, whose length "n" in total, and outputs 

data outputs, Si, 82 8„, whose length Is V In total as encrypted data- and 

said decrypting unit accepts the enciypted data whose length is "n" In total, as data inputs k, k., and 
outputs data outputs, e,. e^ e„. whose length Is "n" In total as decrypted data. ^ ^' 

14. A multi-stage converter characterized by comprising: 

a "ImT' °J "^"^ ^ ^^°^di"g to claim 7; and 
a multi-stage key-input accepting unit whk;h accepts parameter Inputs a„ ^ a J A and sets a 7'-th 

verter Mj, and characterized In that "•"^^n 
a converter M, included in said "u" number of converters accepts multi-stage conversion inputs k, k, k. 
whose length Is -n" In total, as data inputs, 'npuis, k,, Kg, .... k„ 

tot^"l"l m'"''-^''! tT'^"^' ^^^'^-^^ ^"'^ of converters, are given 

to a converter M,^, included in said V number of converters, as data Inputs, and 
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a converter included in said "u" number of converters outputs data outputs, e^, eg, e„. whose length Is 
"n" in total, as multi-stage conversion outputs. 

15. A multi-stage converter characterized by comprising: 

a "u" number of converters (a "J"-th converter Is called a converter Mj (1^j<u)) according to claim 7; and 
a multi-stage key-Input accepting unit which accepts parameter inputs a^, aa, a^ G A, and sets a "j-'-th 
parameter input, aj, included in the accepted parameter inputs, as a predetermined parameter "a" of the con- 
verter Mi, and characterized In that 

a converter Included In said "u" number of converters accepts multi-stage conversion inputs, h^ , hg, .... h^. 
whose length is "n" In total, as data inputs, 

data outputs, which are output by a converter M,^-, (I5i^u-1) included in said "u" number of converters, are 
given to a converter Mi included in said "u" number of converters, as data inputs, and 
a converter Mi Included in said "u" number of converters outputs data outputs, s^, Sg, s^. whose length is 
"n* in total, as multi-stage conversion outputs. 

16. An encryption/decryption system including the multi-stage converter according to claim 14 as an encrypting unit 
and the multi-stage converter according to claim 15 as a decrypting unit, and characterized In that: 

"F,", "G|", " * \ and ')© are commonly used by said encrypting unit and said decrypting unit; 

parameter inputs, ai, ag, .... a^, are commonly accepted by said encrypting unit and said decrypting unit; ^ 

said encrypting unit accepts original data as multi-stage conversion Inputs, k^, kg k^, whose length is V 

In total, and outputs multi-stage conversion outputs, e^, e^, .... e„, whose length is "n" in total as encrypted 

data; and 

said decrypting unit accepts the encrypted data whose length is "n" in total, as multi-stage conversion inputs, 
h^, hg h„, and outputs data outputs, s^. sg. 8„, whose length is "n" in total as decrypted data. 

17. An encryption/decryption system including the multi-stage converter according to claim 1 4 as an encrypting unit 
and the multi-stage converter according to claim 16 as a decrypting unit, and charactarlzed In that: 

"Ff, "G " -ft and *® are commonly used by said encrypting unit and said decrypting unit; 
parameter inputs, a^, ag, a^, are commonly accepted by said encrypting unit and said decrypting unit; ^ 
said encrypting unit accepts original data as multi-stage conversion inputs, h^. ha, h^, whose length is "n" 
in total, and outputs multi-stage conversion outputs, s^, Sg, s„, whose length Is "n" In total as encrypted 

data; and , . 

said decrypting unit accepts the encrypted data whose length is "n" in total, as multi-stage conversion inputs, 
ki, kg, K and outputs data outputs, e^, eg, e^, whose length is "n" in total as decrypted data. 

18. A converting method using: 

an "n" (n^1) number of conversion functions, F,: AxA->A (1<i<n). with respect to a domain A; 

a binary arlthmetfe operation, i( : Ax A->A. and its reverse binary arithmetic operation,® : AxA-^A, and said 

converting being characterized In that, 

for art)itrary x G A, y G A, conditions of 

(x*y)®y=x, and 

(>@y) * y=x 

are satisfied; and 
a predetemiined parameter, a G A, and 

said converting method comprising a generating step, a key accepting step, a repetition controlling step, a 
data accepting step, and a converting step, and characterized In that: 

said generating step Includes accepting generated inputs, x^. Xg, G A, whose length is "n" in total, 
and generating generated outputs, y^, yg yn G A, whose length is "n" in total using recunrence formulas, 

yi=F^ (xi.a), 

and 
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= Fm Ki^VO (1^l<n-1); 

SfnS ^"^^^^^^9 f P includes accepting key inputs, k,, k^, ... k, e A, whose length Is «n" in total, and 
giving the accepted key inputs as generated inputs to said generating step- 
said repetrtion controlling step Includes giving the generated outputs from said generating step as qener- 
ated inputs to said generating step, for an "m" (m>0 number of times, and setting one of thTgenerated 
outputs to be given at end as a random number string, r,, r, r, g A. whose length Is "n" in total- 
said data accepting step includes accepting data inputs, d, . d^ d„ e A. whose length Is "n" in total' and 

ei = di*ri, 

and 

outputting data outputs, e^, e^, e^ G A. whose length Is "n" in total. 
A converting method using; 

an "n- (n^1) number of conversion functions, F,: AXA^A (1^l5n), with respect to a domain A- 

a binary arithmetic operation, T^: AxA-^A, and its reverse binary arithmetic operation, © : AxA~.A. and said 

converter being characterized in that, dna saia 

for arbitrary x e A, y G A, conditions of 

(5<'fry)(o)y=x, and 

(>@y) ^ y=x 

are satisfied; and 
a predetennlned parameter, a G A, and 

said converting iriethod comprising a generating step, a key accepting step, a repetition controlling step a 
data accepting step, and a converting step, and being characterized in that: 

said generating step includes accepting generated inputs, x^, x^, .... x, G A, whose length Is "n" in total 
andgeneratinggeneratedoutputs,y,.y, y^ G A. whose length is "n'Nn total using recu^enceforlJiS 

yi=Fi{Xi.a), 

and 



SLIhe ^Jri!^ 'rT" '"'"''^ ' ^ ^ ^ ^^^^^ '^"9^ total, and 

giving the accepted key Inputs as generated Inputs to said generating step- 
said repetition controlling step includes giving the generated outputs from said generating step as gener- 
ated inputs to said generating step, for an "m" (m>0) number of times, and setting one of thTgenerated 
outputs to be given at end as a random number string, r„ r,, r„ G A, whose length is V in total- 

said data accepting step includes accepting data Inputs, d,. d^ d„ e A. whose length is "n- in total; and 

said converting step includes converting data for any integers "i" in a range between 1 and "n" using a 



and 

outputting data outputs, e^, e„ G A, whose length is "n" in total. 
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20. The converting method according to claim 18, characterized In that 

each of the binary arithmetic operations® and is is exclusive OR. 

21. The converting method according to claim 18, characterized In that 

at least one of the conversion functions F, defined by positive integers M, s, satisfies following conditions, 
for an arbitrary integer parameter b (1^<M«), 

F,(x, b) = ceil(xM'/b) (1^x<b), 

and 

Fj (X, b) = floor (M* (x-by(M*-b)) + 1 (b<x^M*), 

in cases where: 

"ceil (•)" represents that decimals should be rounded off to a next whole number in "M" number system; and 
"floor (0" represents that decimals should be cut off In "M" number system, 

22. The converting method according to claim 18, characterized In that 

at least one of the conversion functions F, defined by positive integers M. s, satisfies following conditions, 
for an arbitrary integer parameter, b {1<b<M»), 

F,(y. b) = Xi (q<Xi); 

F, (y, b) - x2 (Xi^q), 

where 

X,, - floor (M'* by); 
X2 = cell ((M"Vl)y + IVI*); 
q = b(Xa-MV(b-M'), 

In cases where: 

-ceil (.)" represents that decimals should be rounded off to a next whole number In "M" number system; and 
-floor (•)- represents that decimals should be cut off in "M" number system. 

23. A converting method using: 

an "n" {n^1 ) number of conversion functions, F|: AxA-^A. (1 ^i^) and their reverse conversion functions, G(. 
AxA->A, with respect to a domain A, wherein, for arbitrary x G A and y G A, conditions of 

F, (Gi(x,y). y) = x, 

and 

Gi (F((x.y),y) = x. 



30 



EP 1 289 186 A2 

are satisfied; 

a binary arithmetic operation, * : A^-^A" and Its reverse binary arithmetic 
operation,® : An^A", wherein, for arbitrary z E A", conditions of 
* (® 2) = z, and 

® (iV z) = z 
are satisfied; and 
a predetermined parameter, a e A, and 

«n!?fnZf VH'^ ^^^^""^ 3'""'"*"^ '"P"^'' ^2 G A, whoss length IS "n» In total, 

andgenemtlnggeneratedoutputs,y,.y2 y„ e A. whose length is V In total using moilrence formula!; 

yi = Fi (x„a), 

and 

said data aa:eptlng step includes accepting data Inputs. k„ |<„ £ a, whose length is "n" in total 

and giving the accepted data Inputs as generated inputs to safd generating step ^ " 
fST!"?" '^"•''"""S^^^P '"'^'"d^^ g'v'^g the generated outputs from said generating step as gener- 
ated inputs to said generating step, for an "m" (m>0 number of times, and setting one of the generated 

outputs to be given at end as a random number string, r„ r^ r„ e A, whose iength Is "n" InK arS 

said converting step includes applying a single-tern, arithmetic operation. ^. to the random numtjerstring 
»■„ e A, to perfonn its data conversion, that is, 

<««'«2 0= *(ri,r»...,r,), 

and 

outputting data outputs, e^, e^, .... en, whose length is "n" in total. 
A converting method using; 

AvT f J") """^t,er Of conv^^^^^^^ functions, F,; AxA->A (1<i<n), and their reverse conversion functions, G- 
AxA^A, with respect to a domain A. wherein, for arbftrary x e A and y g A, conditions of 

^\ (G|(x.y).y) = x, 

and 



(F|(x.y).y) = x. 

are satisfied; 

a binary arithmetic operation, * : An^A" and its reverse binary arithmetic operation, (3) • An^A" wherein 
for ariDitrary z G A", conditions of ' ^ . « . wnerein, 

^ (® 2) = 2, and 

® (*2) = z 

are satisfied; and 

a predetennined parameter, a G A, and 

rtrrg"s,r::rr.r 



31 



EP 1289 186 A2 



said generating step includes accepting generated inputs, x^. Xg, x^ 6 A, whose length is "n" in total, 
and generating generated outputs, yi , Yg. • Yn ^ A, whose length Is "n" in total using recunrence formulas, 

y^=G^(Xi.a), 

and 

said data accepting step includes accepting data inputs, h^, hg. h„ G A, whose length is "n" in total; 
said converting step includes applying a single-temn arithmetic operation, "Sr. to the data inputs, h^, hg, ... 

hn, to perform Its data conversion, that Is, 

(vi,V2, ...,v^= -sVCh^ba, ....hj, 

and 

giving results of the data conversion, v^, V2, v^, to said generating step; and 
said repetition controlling step Includes giving the generated outputs from said generating step as gener- 
ated inputs to said generating step, for an "m" (m^) number of times, and setting one of the generated 
outputs to be given at end as data outputs, s^. S2, .... s^ G A, whose length Is "n" In total. 

25. The converting method according to claim 23, characterized In that 

In cases where "A" represents a "t"-number bit space, and "z G A"" corresponds to a bit string having "tn" 
bits in length, in the single-term arithmetic operation® , bits in the bit string are shifted by a predetermined number 
of bits in a predetermined direction, and its resultant bit string is set to correspond to An, thereby obtaining a result 
of the singie-tenm arithmetic operation® . 

26. The converting method according to claim 23, characterized In that 

at least one of the conversion functions Fj defined by positive integers M, s. satisfies following conditions, 
for an arbitrary Integer parameter b (1^^M»). 

Fi(x, b) = cell (xM'/b) (1<x5b), 

and 

F, (X, b) = floor (M^ (x-b)/(M^-b)) + 1 (b<x^M^), 

in cases where: 

"ceil (•)" represents that decimals should be rounded off to a next whole number In "M" number system; and 
"floor (•)" represents that decimals should be cut off in "M" number system. 

27. The converting method according to claim 23, characterized in that 

at least one of the conversion functions F, defined by positive integers M. s, satisfies following conditions, 
for an arbitrary integer parameter, b (1^b:SM*). 

Fj (y, b)-Xi (q<x^): 
F,(y. b) = X2(x^^q). 

where 
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= floor (M"' by); 
X2-ceil ((M"Vl)y4.M'); 
q = b (Xg-M V(b-M®), 



in cases where: 



'^ll'LT^'^"'' °« t° a "ext whole number in "M" number system- and 

floor (.)" represents that decimals should be cut off in "M" number system. 

28. A multi-stage converting method characterized by comprising: 

a "u- number of converting steps (a T-th converting step is called a com^erting step IM, (Klai)) of usina the 
converting method according to claim 23; and ' * ^ 

a multi-stage i<ey-input accepting step of accepting parameter inputs a, a, a e A whose lenoth i« "n" m 

oar mTtar" " "?t: "^""'^ ^' '"^'"'^^^ ^" ^^^P'^^ iaSnete^ inpl aTa ^Sl nJ^ 

parameter "a" of the converting step Mj, and wherein K>««iBiemiinea 

inputs, k^, kg I<„, whose length is V in total, as data inputs 

data outputs, which are output at a converting step M, (1dsu-1) Included in said "u" number of convertina 

a converting Step M included in said "u" number of converting steps includes outpiing drojut e, 
^2 e^, Whose length IS V in total, as multi-stage conversion outputs. v^^'^v 

29. A multi-stage converting method characterized by comprising: 

a "u" number of converting steps (a "j--th com/erting step is caHed a converting step M, (ista,)) of usina the 
converting method according to claim 24; and ""jpsisu;; or using the 

a multi-stage key-input accepting step of accepting parameter inputs a,, a^ a„ g A whose lenath Is "n" in 

total, and setting a "J-th parameter input, a,, included in the accepted par^eter inpuVaTa prX^ln 
parameter V of the converting step Mj, and wherein 'er inputs, as a predetermined 

inputs, n^ , ng, t\„, whose length is "n" in total, as data inpute 

d^a outputs, which are output at a converting step IM^, (1<isu'-1) included in said "u" number of convertina 
steps, are given to a converting step M, included in said "u" number of converting steps, as date npur2 
a converting s eps included in said "u" number of converting steps includes outp^ng 2te oZXs' 
sz, ...,s„, whose length IS V in total, as multi-stage conversion outputs. V^^-^i. 

po'sTe inteairj'?' '° '"''"J f'^'^'^^ ^ the conversion functions F, defined by 

positive integers M, s, is a second degree polynomial in x over module M». and satisfies for an art)it arv ir^i^al 
parameter b (1 ^^ivi^ and a predefined function g of b. the following conditions oft ^ ^ 

Fi(x,b) = 2x{x-i-g(b))modM'. 

■ JJs'itJveTntecprj'''"' *° '» that at least one of the conversion functions F, defined by 

positive integers M, s, is a second degree polynomial in x over module M». and satisfies for an arbit arv in3r 
parameter b (1 and a predefined function g of b. the following condilions oT ^ ^ 

F,(x,b) = 2x(x-i-g(b))modM'. 
.ntegefsM,s,«asecond degree polynomial inxover module M. and satisfies, for an art^itrai integer pa?ar^;^^^^ 
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b (1<b<M*) and a predefined function g of b, the following conditions of: 

F| (X, b) = 2x(x + g(b)) mod M*. 

33. The converting method according to claim 23. characterized in that at least one of the conversion functions F, 
defined by positive integers l\4, s. is a second degree polynomial In x over module M« and satisfies, for an arbitrary 
integer parameter b (1^b5M«) and a predefined function g of b, the following conditions of: 



F| (x, b) = 2x (x + g(b)) mod M*. 

34. A program for controlling a computer to serve as the converter according to any one of claims 1 to 5, 7 to 11 , 30 
and 31. 

35. A program for controlling a computer to serve as the multi-stage converter according to claim 14 or 15. 

36. A program for controlling a computer to execute the converting method according to any one of claims 1 8 to 27, 
32 and 33. 

37. A program for controlling a computer to execute the multi-stage converting method according to claim 28 or 29. 

38. An infomiation recording medium (including any of a compact disk, a flexible disk, a hard disk, a magneto-optical 
disk, a digital video disk, a magnetic tape, and a semiconductor memory) storing the program according to claim 34. 

39. An infomiation recording medium (including any of a compact disk, a flexible disk, a hard disk, a magneto-optical 
disk, a digital video disk, a magnetictape. and a semiconductor memory) storing the program according to claim 35. 

40. An information recording medium (including any of a compact disk, a flexible disk, a hard disk, a magneto-optical 
30 disk, a digital video disk, a magnetic tape, and a semiconductor memory) storing the program according to claim 36. 

41. An Infomiation recording medium (including any of a compact disk, a flexible disk, a hard disk, a magneto-optical 
disk, a digital video disk, a magnetictape, and a semteonductor memory) storing the program according to claim 37. 
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